日本語

CWE-868 ビュー詳細

CWE-868

Weaknesses Addressed by the SEI CERT C++ Coding Standard (2016 Version)
2011-08-04 +00:00
Obsolete
Graph
2023-06-29 +00:00
CWE Mitre.org
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
通知を管理する

名前: Weaknesses Addressed by the SEI CERT C++ Coding Standard (2016 Version)

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

CWE メンバー

CWE-876: Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer ベース
CWE-128: Wrap-around Error ベース
CWE-131: Incorrect Calculation of Buffer Size ベース
CWE-190: Integer Overflow or Wraparound ベース
CWE-20: Improper Input Validation ベース
CWE-226: Sensitive Information in Resource Not Removed Before Reuse ベース
CWE-244: Improper Clearing of Heap Memory Before Release ベース
CWE-252: Unchecked Return Value ベース
CWE-391: DEPRECATED: Unchecked Error Condition ベース
CWE-404: Improper Resource Shutdown or Release ベース
CWE-415: Double Free ベース
CWE-416: Use After Free ベース
CWE-476: NULL Pointer Dereference ベース
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere ベース
CWE-590: Free of Memory not on the Heap ベース
CWE-591: Sensitive Data Storage in Improperly Locked Memory ベース
CWE-665: Improper Initialization ベース
CWE-687: Function Call With Incorrectly Specified Argument Value ベース
CWE-690: Unchecked Return Value to NULL Pointer Dereference ベース
CWE-703: Improper Check or Handling of Exceptional Conditions ベース
CWE-754: Improper Check for Unusual or Exceptional Conditions ベース
CWE-762: Mismatched Memory Management Routines ベース
CWE-770: Allocation of Resources Without Limits or Throttling ベース
CWE-822: Untrusted Pointer Dereference ベース
CWE-877: Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer ベース
CWE-134: Use of Externally-Controlled Format String ベース
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ベース
CWE-241: Improper Handling of Unexpected Data Type ベース
CWE-276: Incorrect Default Permissions ベース
CWE-279: Incorrect Execution-Assigned Permissions ベース
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ベース
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition ベース
CWE-37: Path Traversal: '/absolute/pathname/here' ベース
CWE-379: Creation of Temporary File in Directory with Insecure Permissions ベース
CWE-38: Path Traversal: '\absolute\pathname\here' ベース
CWE-39: Path Traversal: 'C:dirname' ベース
CWE-391: DEPRECATED: Unchecked Error Condition ベース
CWE-403: Exposure of File Descriptor to Unintended Control Sphere ベース
CWE-404: Improper Resource Shutdown or Release ベース
CWE-41: Improper Resolution of Path Equivalence ベース
CWE-552: Files or Directories Accessible to External Parties ベース
CWE-59: Improper Link Resolution Before File Access ベース
CWE-62: UNIX Hard Link ベース
CWE-64: Windows Shortcut Following (.LNK) ベース
CWE-65: Windows Hard Link ベース
CWE-67: Improper Handling of Windows Device Names ベース
CWE-675: Multiple Operations on Resource in Single-Operation Context ベース
CWE-676: Use of Potentially Dangerous Function ベース
CWE-73: External Control of File Name or Path ベース
CWE-732: Incorrect Permission Assignment for Critical Resource ベース
CWE-770: Allocation of Resources Without Limits or Throttling ベース

CWE ビュー情報

脆弱性マッピングノート

理由 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
コメント : Use this View or other Views to search and navigate for the appropriate weakness.

ノート

The relationships in this view were determined based on specific statements within the rules from the standard. Not all rules have direct relationships to individual weaknesses, although they likely have chaining relationships in specific circumstances.

対象者

ステークホルダー 説明
Software Developers By following the CERT C++ Secure Coding Standard, developers will be able to fully or partially prevent the weaknesses that are identified in this view. In addition, developers can use a CWE coverage graph to determine which weaknesses are not directly addressed by the standard, which will help identify and resolve remaining gaps in training, tool acquisition, or other approaches for reducing weaknesses.
Product Customers If a software developer claims to be following the CERT C++ Secure Coding Standard, then customers can search for the weaknesses in this view in order to formulate independent evidence of that claim.
Educators Educators can use this view in multiple ways. For example, if there is a focus on teaching weaknesses, the educator could link them to the relevant Secure Coding Standard.

登録情報

名前 組織 日付 リリース日 Version
CWE Content Team MITRE 2011-08-04 +00:00 2011-09-13 +00:00 2.1

変更履歴

名前 組織 日付 コメント
CWE Content Team MITRE 2019-01-03 +00:00 updated Description, Maintenance_Notes, Name, References
CWE Content Team MITRE 2020-02-24 +00:00 updated View_Audience
CWE Content Team MITRE 2021-03-15 +00:00 updated Description, Maintenance_Notes
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes

参考文献

REF-847

SEI CERT C++ Coding Standard
The Software Engineering Institute.
https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?pageId=88046682

CVE Findに掲載されている情報は、慎重に選定された複数の参照ソースから取得されています。CVEデータはMITRE Corporationおよび国家脆弱性データベース（NVD）が提供しています。既知の悪用された脆弱性（KEV）カタログはサイバーセキュリティ・インフラセキュリティ庁（CISA）から、EPSSスコアはFIRST.orgから取得しています。また、ソフトウェアの弱点（CWE）および共通攻撃パターン（CAPEC）に関するデータはMITRE Corporationが管理し、ハードウェアおよびソフトウェア構成（CPE）に関する情報はNVDが提供しています。